chore(deps): update node.js to v20 #1778

renovate · 2023-10-28T12:04:40Z

This PR contains the following updates:

Package	Type	Update	Change
node (source)	volta	major	`18.19.0` -> `20.13.1`
node (source)	engines	major	`<19` -> `<21`

Release Notes

nodejs/node (node)

`v20.13.1`: 2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

Compare Source

2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

Revert "tools: install npm PowerShell scripts on Windows"

Due to a regression in the npm installation on Windows, this commit reverts the change that installed npm PowerShell scripts on Windows.

Commits

[b7d80802cc] - Revert "tools: install npm PowerShell scripts on Windows" (marco-ippolito) #52897

`v20.13.0`

Compare Source

`v20.12.2`: 2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

[69ffc6d50d] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#563

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-44487: nghttp2 Security Release (High)
CVE-2023-45143: undici Security Release (High)
CVE-2023-39332: Path traversal through path stored in Uint8Array (High)
CVE-2023-39331: Permission model improperly protects against path traversal (High)
CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium)
CVE-2023-39333: Code injection via WebAssembly export names (Low)

More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post.

Commits

[c86883e844] - deps: update nghttp2 to 1.57.0 (James M Snell) #50121
[2860631359] - deps: update undici to v5.26.3 (Matteo Collina) #50153
[cd37838bf8] - lib: let deps require node prefixed modules (Matthew Aitken) #50047
[f5c90b2951] - module: fix code injection through export names (Tobias Nießen) nodejs-private/node-private#461
[fa5dae1944] - permission: fix Uint8Array path traversal (Tobias Nießen) nodejs-private/node-private#456
[cd35275111] - permission: improve path traversal protection (Tobias Nießen) nodejs-private/node-private#456
[a4cb7fc7c0] - policy: use tamper-proof integrity check function (Tobias Nießen) nodejs-private/node-private#462

`v20.8.0`: 2023-09-28, Version 20.8.0 (Current), @ruyadorno

Compare Source

Notable Changes

Stream performance improvements

Performance improvements to writable and readable streams, improving the creation and destruction by ±15% and reducing the memory overhead each stream takes in Node.js

Contributed by Benjamin Gruenbaum in #49745 and Raz Luvaton in #49834.

Performance improvements for readable webstream, improving readable stream async iterator consumption by ±140% and improving readable stream pipeTo consumption by ±60%

Contributed by Raz Luvaton in #49662 and #49690.

Rework of memory management in `vm` APIs with the `importModuleDynamically` option

This rework addressed a series of long-standing memory leaks and use-after-free issues in the following APIs that support importModuleDynamically:

vm.Script
vm.compileFunction
vm.SyntheticModule
vm.SourceTextModule

This should enable affected users (in particular Jest users) to upgrade from older versions of Node.js.

Contributed by Joyee Cheung in #48510.

Other notable changes

[32d4d29d02] - deps: add v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung) #49874
[0e686d096b] - doc: deprecate fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK (Livia Medeiros) #49683
[a5dd057540] - doc: deprecate util.toUSVString (Yagiz Nizipli) #49725
[7b6a73172f] - doc: deprecate calling promisify on a function that returns a promise (Antoine du Hamel) #49647
[1beefd5f16] - esm: set all hooks as release candidate (Geoffrey Booth) #49597
[b0ce78a75b] - module: fix the leak in SourceTextModule and ContextifySript (Joyee Cheung) #48510
[4e578f8ab1] - module: fix leak of vm.SyntheticModule (Joyee Cheung) #48510
[69e4218772] - module: use symbol in WeakMap to manage host defined options (Joyee Cheung) #48510
[14ece0aa76] - (SEMVER-MINOR) src: allow embedders to override NODE_MODULE_VERSION (Cheng Zhao) #49279
[9fd67fbff0] - stream: use bitmap in writable state (Raz Luvaton) #49834
[0ccd4638ac] - stream: use bitmap in readable state (Benjamin Gruenbaum) #49745
[7c5e322346] - stream: improve webstream readable async iterator performance (Raz Luvaton) #49662
[80b342cc38] - (SEMVER-MINOR) test_runner: accept testOnly in run (Moshe Atlow) #49753
[17a05b141d] - (SEMVER-MINOR) test_runner: add junit reporter (Moshe Atlow) #49614

Commits

[4879e3fbbe] - benchmark: add a benchmark for read() of ReadableStreams (Debadree Chatterjee) #49622
[78a6c73157] - benchmark: shorten pipe-to by reducing number of chunks (Raz Luvaton) #49577
[4126a6e4c9] - benchmark: fix webstream pipe-to (Raz Luvaton) #49552
[6010a91825] - bootstrap: do not expand argv1 for snapshots (Joyee Cheung) #49506
[8480280c4b] - bootstrap: only use the isolate snapshot when compiling code cache (Joyee Cheung) #49288
[b30754aa87] - build: run embedtest using node executable (Joyee Cheung) #49506
[31db0b8e2b] - build: add --write-snapshot-as-array-literals to configure.py (Joyee Cheung) #49312
[6fcb51d3ba] - debugger: use internal/url.URL instead of url.parse (LiviaMedeiros) #49590
[32d4d29d02] - deps: add v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung) #49874
[ad37cadc3f] - deps: V8: backport de9a5de (Joyee Cheung) #49703
[cdd1c66222] - deps: V8: cherry-pick b33bf2d (Joyee Cheung) #49703
[61d18d6473] - deps: update undici to 5.24.0 (Node.js GitHub Bot) #49559
[b8a4fef393] - deps: remove pthread-fixes.c from uv.gyp (Ben Noordhuis) #49744
[6c86c0683c] - deps: update googletest to d1467f5 (Node.js GitHub Bot) #49676
[1424404742] - deps: update nghttp2 to 1.56.0 (Node.js GitHub Bot) #49582
[15b54ff95d] - deps: update googletest to 8a6feab (Node.js GitHub Bot) #49463
[2ceab877c2] - deps: update corepack to 0.20.0 (Node.js GitHub Bot) #49464
[4814872ddc] - doc: fix DEP0176 number (LiviaMedeiros) #49858
[0e686d096b] - doc: deprecate fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK (Livia Medeiros) #49683
[5877c403a2] - doc: add mertcanaltin as a triager (mert.altin) #49826
[864fe56432] - doc: add git node backport way to the backporting guide (Raz Luvaton) #49760
[e0f93492d5] - doc: improve documentation about ICU data fallback (Joyee Cheung) #49666
[a5dd057540] - doc: deprecate util.toUSVString (Yagiz Nizipli) #49725
[774c1cfd52] - doc: add missing function call to example for util.promisify (Jungku Lee) #49719
[fe78a34845] - doc: update output of example in mimeParams.set() (Deokjin Kim) #49718
[4175ea33bd] - doc: add missed inspect with numericSeparator to example (Deokjin Kim) #49717
[3a88571972] - doc: fix history comments (Antoine du Hamel) #49701
[db4ab1ccbb] - doc: add missing history info for import.meta.resolve (Antoine du Hamel) #49700
[a304d1ee19] - doc: link maintaining deps to pull-request.md (Marco Ippolito) #49716
[35294486ad] - doc: fix print results in events (Jungku Lee) #49548
[9f0b0e15c9] - doc: alphabetize cli.md sections (Geoffrey Booth) #49668
[7b6a73172f] - doc: deprecate calling promisify on a function that returns a promise (Antoine du Hamel) #49647
[d316b32fff] - doc: update corepack.md to account for 0.20.0 changes (Antoine du Hamel) #49486
[c2eac7dc7c] - doc: remove @anonrig from performance initiative (Yagiz Nizipli) #49641
[3d839fbf87] - doc: mark Node.js 16 as End-of-Life (Richard Lau) #49651
[53fb5aead8] - doc: save user preference for JS flavor (Vidar Eldøy) #49526
[e3594d5658] - doc: update documentation for node:process warning (Shubham Pandey) #49517
[8e033c3963] - doc: rename possibly confusing variable and CSS class (Antoine du Hamel) #49536
[d0e0eb4bb3] - doc: update outdated history info (Antoine du Hamel) #49530
[b4724e2e3a] - doc: close a parenthesis (Sébastien Règne) #49525
[0471c5798e] - doc: cast GetInternalField() return type to v8::Value in addons.md (Joyee Cheung) #49439
[9f8bea3dda] - doc: fix documentation for input option in child_process (Ariel Weiss) #49481
[f3fea92f8a] - doc: fix missing imports in test.run code examples (Oshri Asulin) #49489
[e426b77b67] - doc: fix documentation for fs.createWriteStream highWaterMark option (Mert Can Altın) #49456
[2b119108ff] - doc: updated releasers instructions for node.js website (Claudio W) #49427
[b9d4a80183] - doc: edit import.meta.resolve documentation (Antoine du Hamel) #49247
[f67433f666] - doc,tools: switch to @node-core/utils (Michaël Zasso) #49851
[142e256fc5] - errors: improve classRegExp in errors.js (Uzlopak) #49643
[6377f1bce2] - errors: use determineSpecificType in more error messages (Antoine du Hamel) #49580
[05f0fcb4c4] - esm: identify parent importing a url with invalid host (Jacob Smith) #49736
[8a6f5fb8f3] - esm: fix return type of import.meta.resolve (Antoine du Hamel) #49698
[a6140f1b8c] - esm: update loaders warning (Geoffrey Booth) #49633
[521a9327e0] - esm: fix support for URL instances in register (Antoine du Hamel) #49655
[3a9ea0925a] - esm: clarify ERR_REQUIRE_ESM errors (Daniel Compton) #49521
[1beefd5f16] - esm: set all hooks as release candidate (Geoffrey Booth) #49597
[be48267888] - esm: remove return value for Module.register (Antoine du Hamel) #49529
[e74a075124] - esm: refactor test-esm-loader-resolve-type (Geoffrey Booth) #49493
[17823b3533] - esm: refactor test-esm-named-exports (Geoffrey Booth) #49493
[f34bd15ac1] - esm: refactor mocking test (Geoffrey Booth) #49465
[ec323bbd99] - fs: replace SetMethodNoSideEffect in node_file (CanadaHonk) #49857
[6acf800123] - fs: improve error performance for unlinkSync (CanadaHonk) #49856
[31702c9403] - fs: improve readFileSync with file descriptors (Yagiz Nizipli) #49691
[835f9fe7b9] - fs: fix file descriptor validator (Yagiz Nizipli) #49752
[b618fe262f] - fs: improve error performance of opendirSync (Yagiz Nizipli) #49705
[938471ef55] - fs: improve error performance of sync methods (Yagiz Nizipli) #49593
[db3fc6d087] - fs: fix readdir and opendir recursive with unknown file types (William Marlow) #49603
[0f020ed22d] - gyp: put cctest filenames in variables (Cheng Zhao) #49178
[0ce1e94d12] - lib: update encoding sets in WHATWG API (Jungku Lee) #49610
[efd6815a7a] - lib: fix internalBinding typings (Yagiz Nizipli) #49742
[1287d5b74e] - lib: allow byob reader for 'blob.stream()' (Debadree Chatterjee) #49713
[bbc710522d] - lib: reset the cwd cache before execution (Maël Nison) #49684
[f62d649e4d] - lib: use internal fileURLToPath (Deokjin Kim) #49558
[e515046941] - lib: use internal pathToFileURL (Livia Medeiros) #49553
[00608e8070] - lib: check SharedArrayBuffer availability in freeze_intrinsics.js (Milan Burda) #49482
[8bfbe7079c] - meta: fix linter error (Antoine du Hamel) #49755
[58f7a9e096] - meta: add primordials strategic initiative (Benjamin Gruenbaum) #49706
[5366027756] - meta: bump github/codeql-action from 2.21.2 to 2.21.5 (dependabot[bot]) #49438
[fe26b74082] - meta: bump rtCamp/action-slack-notify from 2.2.0 to 2.2.1 (dependabot[bot]) #49437
[b0ce78a75b] - module: fix the leak in SourceTextModule and ContextifySript (Joyee Cheung) #48510
[4e578f8ab1] - module: fix leak of vm.SyntheticModule (Joyee Cheung) #48510
[69e4218772] - module: use symbol in WeakMap to manage host defined options (Joyee Cheung) #48510
[96874e8fbc] - node-api: enable uncaught exceptions policy by default (Chengzhong Wu) #49313
[b931aeadfd] - perf_hooks: reduce overhead of new performance_entries (Vinicius Lourenço) #49803
[ad043bac31] - process: add custom dir support for heapsnapshot-signal (Jithil P Ponnan) #47854
[8a7c10194c] - repl: don't accumulate excess indentation in .load (Daniel X Moore) #49461
[10a2adeed5] - src: improve error message when ICU data cannot be initialized (Joyee Cheung) #49666
[ce37688bac] - src: remove unnecessary todo (Rafael Gonzaga) #49227
[f611583b71] - src: use SNAPSHOT_SERDES to log snapshot ser/deserialization (Joyee Cheung) #49637
[a597cb8457] - src: port Pipe to uv_pipe_bind2, uv_pipe_connect2 (Geoff Goodman) #49667
[fb21062338] - src: set --rehash-snapshot explicitly (Joyee Cheung) #49556
[14ece0aa76] - (SEMVER-MINOR) src: allow embedders to override NODE_MODULE_VERSION (Cheng Zhao) #49279
[4b5e23c71b] - src: set ModuleWrap internal fields only once (Joyee Cheung) #49391
[2d3f5c7cab] - src: fix fs_type_to_name default value (Mustafa Ateş Uzun) #49239
[cfbcb1059c] - src: fix comment on StreamResource (rogertyang) #49193
[39fb83ad16] - src: do not rely on the internal field being default to undefined (Joyee Cheung) #49413
[9fd67fbff0] - stream: use bitmap in writable state (Raz Luvaton) #49834
[0ccd4638ac] - stream: use bitmap in readable state (Benjamin Gruenbaum) #49745
[b29d927010] - stream: improve readable webstream pipeTo (Raz Luvaton) #49690
[7c5e322346] - stream: improve webstream readable async iterator performance (Raz Luvaton) #49662
[be211ef818] - test: deflake test-vm-contextified-script-leak (Joyee Cheung) #49710
[355f10dab2] - test: use checkIfCollectable in vm leak tests (Joyee Cheung) #49671
[17cfc531aa] - test: add checkIfCollectable to test/common/gc.js (Joyee Cheung) #49671
[e49a573752] - test: add os setPriority, getPriority test coverage (Wael) #38771
[5f02711522] - test: deflake test-runner-output (Moshe Atlow) #49878
[cd9754d6a7] - test: mark test-runner-output as flaky (Joyee Cheung) #49854
[5ad00424dd] - test: use mustSucceed instead of mustCall (SiddharthDevulapalli) #49788
[3db9b40081] - test: refactor test-readline-async-iterators into a benchmark (Shubham Pandey) #49237
[2cc5ad7859] - Revert "test: mark test-http-regr-gh-2928 as flaky" (Luigi Pinca) #49708
[e5185b053c] - test: use fs.constants for fs.access constants (Livia Medeiros) #49685
[b9e5b43462] - test: deflake test-http-regr-gh-2928 (Luigi Pinca) #49574
[1fffda504e] - test: fix argument computation in embedtest (Joyee Cheung) #49506
[6e56f2db52] - test: skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) #49621
[ab3afb330d] - test: mark test-runner-watch-mode as flaky (Joyee Cheung) #49627
[185d9b50db] - test: deflake test-tls-socket-close (Luigi Pinca) #49575
[c70c74a9e6] - test: show more info on failure in test-cli-syntax-require.js (Joyee Cheung) #49561
[ed7c6d1114] - test: mark test-http-regr-gh-2928 as flaky (Joyee Cheung) #49565
[3599eebab9] - test: use spawnSyncAndExitWithoutError in sea tests (Joyee Cheung) #49543
[f79b153e89] - test: use spawnSyncAndExitWithoutError in test/common/sea.js (Joyee Cheung) #49543
[c079c73769] - test: use setImmediate() in test-heapdump-shadowrealm.js (Joyee Cheung) #49573
[667a92493c] - test: skip test-child-process-pipe-dataflow.js on Windows (Joyee Cheung) #49563
[91af0a9a3c] - Revert "test: ignore the copied entry_point.c" (Chengzhong Wu) #49515
[567afc71b8] - test: avoid copying test source files (Chengzhong Wu) #49515
[ced25a976d] - test: increase coverage of Module.register and initialize hook (Antoine du Hamel) #49532
[be02fbdb8a] - test: isolate globalPreload tests (Geoffrey Booth) #49545
[f214428845] - test: split test-crypto-dh to avoid timeout on slow machines in the CI (Joyee Cheung) #49492
[3987094569] - test: make test-dotenv-node-options locale-independent (Livia Medeiros) #49470
[34c1741792] - test: add test for urlstrings usage in node:fs (Livia Medeiros) #49471
[c3c6c4f007] - test: make test-worker-prof more robust (Joyee Cheung) #49274
[843df1a4da] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #49714
[80b342cc38] - (SEMVER-MINOR) test_runner: accept testOnly in run (Moshe Atlow) #49753
[76865515b9] - test_runner: fix test runner watch mode when no positional arguments (Moshe Atlow) #49578
[17a05b141d] - (SEMVER-MINOR) test_runner: add junit reporter (Moshe Atlow) #49614
[5672e38457] - test_runner: add jsdocs to mock.js (Caio Borghi) #49555
[b4d42a8f2b] - test_runner: fix invalid timer call (Erick Wendel) #49477
[f755e6786b] - test_runner: add jsdocs to MockTimers (Erick Wendel) #49476
[e7285d4bf0] - test_runner: fix typescript coverage (Moshe Atlow) #49406
[07a2e29bf3] - tools: support updating @reporters/github manually (Moshe Atlow) #49871
[5ac6722031] - tools: skip ruff on tools/node_modules (Moshe Atlow) #49838
[462228bd24] - tools: fix uvwasi updater (Michael Dawson) #49682
[ff81bfb958] - tools: update lint-md-dependencies to rollup@3.29.2 (Node.js GitHub Bot) #49679
[08ffc6344c] - tools: restrict internal code from using public url module (LiviaMedeiros) #49590
[728ebf6c97] - tools: update eslint to 8.49.0 (Node.js GitHub Bot) #49586
[20d038ffb1] - tools: update lint-md-dependencies to rollup@3.29.0 unified@11.0.3 (Node.js GitHub Bot) #49584
[210c15bd12] - tools: allow passing absolute path of config.gypi in js2c (Cheng Zhao) #49162
[e341efe173] - tools: configure never-stale label correctly (Michaël Zasso) #49498
[a8a8a498ce] - tools: update doc dependencies (Node.js GitHub Bot) #49467
[ac06607f9e] - typings: fix missing property in ExportedHooks (Antoine du Hamel) #49567
[097b59807a] - url: improve invalid url performance (Yagiz Nizipli) #49692
[7c2060cfac] - util: add getCwdSafe internal util fn (João Lenon) #48434
[c23c60f545] - zlib: disable CRC32 SIMD optimization (Luigi Pinca) #49511

`v20.7.0`: 2023-09-18, Version 20.7.0 (Current), @UlisesGascon

Compare Source

Notable Changes

[022f1b70c1] - src: support multiple --env-file declarations (Yagiz Nizipli) #49542
[4a1d1cad61] - crypto: update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
[a1a65f593c] - deps: upgrade npm to 10.1.0 (npm team) #49570
[6c2480cad9] - (SEMVER-MINOR) deps: upgrade npm to 10.0.0 (npm team) #49423
[bef900e56b] - doc: move and rename loaders section (Geoffrey Booth) #49261
[db4ce8a593] - doc: add release key for Ulises Gascon (Ulises Gascón) #49196
[11c85ffa98] - (SEMVER-MINOR) lib: add api to detect whether source-maps are enabled (翠 / green) #46391
[ec51e25ed7] - src,permission: add multiple allow-fs-* flags (Carlos Espa) #49047
[efdc95fbc0] - (SEMVER-MINOR) test_runner: expose location of tests (Colin Ihrig) #48975

Commits

[e84515594e] - benchmark: use tmpdir.resolve() (Livia Medeiros) #49137
[f37444e896] - bootstrap: build code cache from deserialized isolate (Joyee Cheung) #49099
[af6dc1754d] - bootstrap: do not generate code cache in an unfinalized isolate (Joyee Cheung) #49108
[cade5716df] - build: add symlink to compile_commands.json file if needed (Juan José) #49260
[34a2590b05] - build: expand when we run internet tests (Michael Dawson) #49218
[f637fd46ab] - build: fix typo libray -> library (configure.py) (michalbiesek) #49106
[ef3d8dd493] - crypto: remove webcrypto EdDSA key checks and properties (Filip Skokan) #49408
[4a1d1cad61] - crypto: update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
[7eb10a38ea] - crypto: remove getDefaultEncoding() (Tobias Nießen) #49170
[772496c030] - crypto: remove default encoding from DiffieHellman (Tobias Nießen) #49169
[c795083232] - crypto: remove default encoding from Hash/Hmac (Tobias Nießen) #49167
[08197aa010] - crypto: remove default encoding from sign/verify (Tobias Nießen) #49145
[a1a65f593c] - deps: upgrade npm to 10.1.0 (npm team) #49570
[6c2480cad9] - (SEMVER-MINOR) deps: upgrade npm to 10.0.0 (npm team) #49423
[84195d9584] - deps: add missing thread-common.c in uv.gyp (Santiago Gimeno) #49410
[5b70b68b3d] - deps: V8: cherry-pick eadaef5 (Adam Majer) #49401
[fe34d632e8] - deps: update zlib to 1.2.13.1-motley-f5fd0ad (Node.js GitHub Bot) #49252
[db4ce8a593] - doc: add release key for Ulises Gascon (Ulises Gascón) #49196
[e5f3a694cf] - doc: fix node-api call example (Chengzhong Wu) #49395
[021345a724] - doc: add news issue for Diagnostics WG (Michael Dawson) #49306
[f82347266b] - doc: clarify policy expectations (Rafael Gonzaga) #48947
[73cfd9c895] - doc: add print results for examples in StringDecoder (Jungku Lee) #49326
[63ab591416] - doc: update outdated reference to NIST SP 800-131A (Tobias Nießen) #49316
[935dfe2afd] - doc: use cjs as block code's type in MockTimers (Deokjin Kim) #49309
[7c0cd2fb87] - doc: update options.filter description for fs.cp (Shubham Pandey) #49289
[f72e79ea67] - doc: add riscv64 to list of architectures (Stewart X Addison) #49284
[d19c710064] - doc: avoid "not currently recommended" (Tobias Nießen) #49300
[ae656101c0] - doc: update module hooks docs (Geoffrey Booth) #49265
[fefbdb92f2] - doc: modify param description for end(),write() in StringDecoder (Jungku Lee) #49285
[59e66a1ebe] - doc: use NODE_API_SUPPORTED_VERSION_MAX in release doc (Cheng Zhao) #49268
[ac3b88449b] - doc: fix typo in stream.finished documentation (Antoine du Hamel) #49271
[7428ebf6c3] - doc: update description for percent_encode sets in WHATWG API (Jungku Lee) #49258
[bef900e56b] - doc: move and rename loaders section (Geoffrey Booth) #49261
[a22e0d9696] - doc: clarify use of Uint8Array for n-api (Fedor Indutny) #48742
[1704f24cb9] - doc: add signature for module.register (Geoffrey Booth) #49251
[5a363bb01b] - doc: caveat unavailability of import.meta.resolve in custom loaders (Jacob Smith) #49242
[8101f2b259] - doc: use same name in the doc as in the code (Hyunjin Kim) #49216
[edf278d60d] - doc: add notable-change label mention to PR template (Rafael Gonzaga) #49188
[3df2251a6a] - doc: add h1 summary to security release process (Rafael Gonzaga) #49112
[9fcd99a744] - doc: update to semver-minor releases by default (Rafael Gonzaga) #49175
[777931f499] - doc: fix wording in napi_async_init (Tobias Nießen) #49180
[f45c8e10c0] - doc,test: add known path resolution issue in permission model (Tobias Nießen) #49155
[a6cfea3f74] - esm: align sync and async load implementations (Antoine du Hamel) #49152
[9fac310b33] - fs: add the options param description in openAsBlob() (Yeseul Lee) #49308
[92772a8175] - fs: remove redundant code in readableWebStream() (Deokjin Kim) #49298
[88ba79b083] - fs: make sure to write entire buffer (Robert Nagy) #49211
[11c85ffa98] - (SEMVER-MINOR) lib: add api to detect whether source-maps are enabled (翠 / green) #46391
[c12711ebfe] - lib: implement WeakReference on top of JS WeakRef (Joyee Cheung) #49053
[9a0891f88d] - meta: bump step-security/harden-runner from 2.5.0 to 2.5.1 (dependabot[bot]) #49435
[ae67f41ef1] - meta: bump actions/checkout from 3.5.3 to 3.6.0 (dependabot[bot]) #49436
[71b4411fb2] - meta: bump actions/setup-node from 3.7.0 to 3.8.1 (dependabot[bot]) #49434
[83b7d3a395] - meta: remove modules team from CODEOWNERS (Benjamin Gruenbaum) #49412
[81ff68c45c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #49264
[ab975233cc] - meta: mention nodejs/tsc when changing GH templates (Rafael Gonzaga) #49189
[ceaa5494de] - meta: add test/reporters to codeowners (Chemi Atlow) #49186
[de0a51b7cf] - net: improve performance of isIPv4 and isIPv6 (Uzlopak) #49568
[8d0913bf95] - net: use asserts in JS Socket Stream to catch races in future (Tim Perry) #49400
[2486836a7d] - net: fix crash due to simultaneous close/shutdown on JS Stream Sockets (Tim Perry) #49400
[7a808340cd] - node-api: fix compiler warning in node_api.h (Michael Graeb) #49103
[30f26a99f4] - permission: ensure to resolve path when calling mkdtemp (RafaelGSS) nodejs-private/node-private#440
[5051c75a5b] - policy: fix path to URL conversion (Antoine du Hamel) #49133
[173aed4757] - report: fix recent coverity warning (Michael Dawson) #48954
[d7ff78b442] - sea: generate code cache with deserialized isolate (Joyee Cheung) #49226
[022f1b70c1] - src: support multiple --env-file declarations (Yagiz Nizipli) #49542
[154b1c2115] - src: don't overwrite environment from .env file (Phil Nash) #49424
[dc4de1c69b] - src: modify code for empty string (pluris) #49336
[701c46f967] - src: remove unused PromiseWrap-related code (Joyee Cheung) #49335
[4a094dc7af] - src: rename IsAnyByteSource to IsAnyBufferSource (Tobias Nießen) #49346
[55d6649175] - src: support snapshot deserialization in RAIIIsolate (Joyee Cheung) #49226
[dc092864ef] - src: remove unused function GetName() in node_perf (Jungku Lee) #49244
[f2552a410e] - src: use ARES_SUCCESS instead of 0 (Jungku Lee) #49048
[4a9ae31519] - src: add a condition if the argument of DomainToUnicode is empty (Jungku Lee) #49097
[f460362cdf] - src: remove C++ WeakReference implementation (Joyee Cheung) #49053
[2a35383b3e] - src: use per-realm GetBindingData() wherever applicable (Joyee Cheung) #49007
[184bbddcf5] - src: add per-realm GetBindingData() method (Joyee Cheung) #49007
[e9946885f9] - src: serialize both BaseObject slots (Joyee Cheung) #48996
[[`ec51e

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@dylan-apollo

# [0.24.0] > Important: 1 potentially breaking change below, indicated by **❗ BREAKING ❗** ## ❗ BREAKING ❗ - **Removed the deprecated `plain` and `json` options for `--output` - @dylan-apollo PR [#1804](#1804 The `--output` option is now only for specifying a file to write to. The `--format` option should be used to specify the format of the output. ## 🚀 Features - **Return the name of the linting rule that is violated, as well as the code - @jonathanrainer PR [#1907](#1907 Originally only the message from the linting violation was included in the response, but now it also includes the name of the specific linting rule to aid debugging - **Use the Router's `/health?ready` endpoint to check readiness - @nmoutschen PR [#1939](#1939 Previously `rover dev` used a simple query to establish readiness, but this did not allow for router customizations. - **Adding architecture and OS metrics - @aaronArinder PR [#1947](#1947 Allows us to track the Operating Systems and Architectures in use by our users, this will give us more information as to where to focus support efforts - **Allow `aarch64` macOS to pull correct `supergraph` binaries where available - @jonathanrainer PR [#1971](#1971 We recently started publishing `supergraph` binaries for `aarch64`, so if they are available Rover will use them in preference to x86_64 binaries. ## 🐛 Fixes - **Don't panic if the telemetry client cannot be initialised - @dylan-apollo PR [#1897](#1897) - Issue [#1893](#1893 - **Rename `.cargo/config` to `.cargo/config.toml` - @jonathanrainer PR [#1921](#1921 - **Fix `pnpm` installs by moving the binary download location - @jonathanrainer PR [#1927](#1927) - Issue [#1881](#1881 After we inlined the `binary-install` dependency in v0.23.0 this changed where the downloaded binary was stored when using `pnpm`. This caused users running the binary to enter an infinite loop. This moves the binary to a new location which avoids this. - **Don't panic on file watcher errors - @nmoutschen PR [#1935](#1935 Instead of panicking when errors occur watching files return those errors gracefully to the user. - **Store binaries with version numbers attached so upgrades are possible - @jonathanrainer PR [#1932](#1932) - Issue [#1563](#1563 When downloading binaries via `npm` they were always stored as `rover` despite the version. As such, when a new version came out the upgrade would fail. This now doesn't happen, as binaries are stored with their versions number in the name. - **Ensure correct URL is used if `subgraph_url` and `routing_url` are provided in a supergraph schema - @jonathanrainer PR [#1948](#1948) - Issue [#1782](#1782 - **Let `--output` accept paths with missing intermediate directories - @jonathanrainer PR [#1944](#1944) - Issue [#1787](#1787 - **Allow `rover dev` to read Federation Version from supergraph schema - @jonathanrainer PR [#1950](#1950) - Issue [#1735](#1735 The Federation version could be set in the supegraph schema but was being ignored by `rover dev`. It now is taken into account, along with the overriding environment variable. - **Stop .exe being printed after Federation version during composition - @jonathanrainer PR [#1951](#1951) - Issue [#1390](#1390 - **Reinstate support for `glibc` 2.17 - @jonathanrainer PR [#1953](#1953 In resolving the issues with CentOS 7 we accidentally removed support for `glibc` 2.17, this has now been restored - **Be more lenient about `supergraph` binary versions - @dylan-apollo PR [#1966](#1966 In resolving #1390, we were too restrictive in what counted as a valid version. This restores the correct behaviour - **Set `package.json` to a stable version when testing NPM Installers - @jonathanrainer PR [#1967](#1967 When testing whether our NPM installers worked correctly we were trying to download the latest `rover` binary. On release PRs, where the binary didn't yet exist, this was causing problems. - **Fix mocking of calls to Orbiter in Installer tests - @jonathanrainer PR [#1968](#1968 - **Remove noisy errors from intermediate composition states - @aaronArinder PR [#1956](#1956 When `rover dev` composes multiple subgraphs it does so one at a time. As such if there are dependencies there can be noisy ephemeral errors, this fixes that by waiting until all subgraphs are added before trying composition. ## 🛠 Maintenance - **Update GitHub CircleCI Orb to v2.3.0 - @Geal PR [#1831](#1831 - **Update plugins to Fed 2.7 and Router 1.43.0 - @smyrick PR [#1877](#1877 - **Update CODEOWNERS - @dotdat PR [#1890](#1890 Make Betelgeuse the primary owners of the Rover repository - **Update lychee-lib to v0.15 - @dotData PR [#1902](#1902 - **Add tests and provide status codes as part of linter errors - @dotdat PR [#1903](#1903 - **Add nix files to .gitignore - @aaronArinder PR [#1908](#1908 - **Update apollographql/router to v1.47.0 - @aaronArinder PR [#1841](#1841 - **Update apollographql/federation-rs to v2.7.8 - @aaronArinder PR [#1746](#1746 - **Update node.js to v20 - @aaronArinder PR [#1778](#1778 - **Update Rust to v1.76.0 and the Rust CircleCI Orb to v1.6.1 - @aaronArinder PR [#1788](#1788 - **Update serial_test to v3 - @jonathanrainer PR [#1836](#1836 - **Update which to v6 - @jonathanrainer PR [#1835](#1835 - **Update apollographql/federation-rs to v2.8.0 - @aaronArinder PR [#1909](#1909 - **Update tar to v6.2.1 - @aaronArinder PR [#1888](#1888 - **Update tar to v7 - @aaronArinder PR [#1914](#1914 - **Update node.js packages - @aaronArinder PR [#1830](#1830 Includes `eslint` to v8.57.0, `node.js` to v20.14.0, `nodemon` to v3.1.2, `npm` to v10.8.1 and `prettier` to v3.3.0 - **Update Rust to v1.78.0 - @aaronArinder PR [#1912](#1912 - **Update apollographql/router to v1.48.0 - @aaronArinder PR [#1917](#1917 - **Update zip to v2 - @jonathanrainer PR [#1916](#1916 - **Update eslint to v9.4.0 - @dotdat PR [#1913](#1913 - **Update hyper to v1.0 - @dotdat PR [#1789](#1789 - **Add tests for socket names - @jonathanrainer PR [#1918](#1918 In future dependency upgrades we want to ensure that behaviour around socket naming works as expected, so add a test to ensure that. - **Update rust packages - @jonathanrainer PR [#1755](#1755 Consolidates updates of pre-1.0 rust crates, check PR for full details of crates updated - **Update notify to v6 - @jonathanrainer PR [#1603](#1603 - **Include cargo-deny checks on PRs - @jonathanrainer PR [#1910](#1910 Now we can check for licences that don't correspond to our allowed list and pick up on dependency issues live on PRs - **Pin node.js dev dependencies - @aaronArinder PR [#1923](#1923 - **Allow 0BSD licence - @aaronArinder PR [#1924](#1923 - **Update interprocess to v2 - @dotdat PR [#1915](#1915 - **Update apollographql/router to v1.48.1 - @dotdat PR [#1926](#1926 - **Update Rust to v1.79.0 - @jonathanrainer PR [#1931](#1931 - **Update git2 to v0.19 - @jonathanrainer PR [#1930](#1930 - **Update node.js packages - @jonathanrainer PR [#1929](#1929 Includes `@eslint/compat` to v1.1.0, `eslint` to v9.5.0, `graphql` to v16.8.2 and `prettier` to v3.3.2 - **Migrate CI to use manylinux rather than CentOS 7 - @jonathanrainer PR [#1952](#1952 As CentOS 7 has now entered End-of-Life, migrate our CI to use a different Linux distribution. - **Update apollographql/router to v1.49.1 - @jonathanrainer PR [#1933](#1933 - **Update apollographql/federation-rs to v2.8.2 - @jonathanrainer PR [#1934](#1934 - **Update node.js packages - @jonathanrainer PR [#1940](#1940 Includes `eslint` to v9.6.0, `node.js` to v20.15.0, `nodemon` to v3.1.4, `graphql` to v16.9.0 - **Fix clippy warnings - @loshz PR [#1955](#1955 - **Allow integration tests to accept a pre-compiled binary - @jonathanrainer PR [#1957](#1957 - **Run macOS x86_64 integration tests in GitHub Actions - @nmoutschen PR [#1958](#1958 Due to CircleCI's deprecation of x86_64 macOS executors use GitHub Actions to still run our tests on this architecture - **Add smoke tests for `rover dev` - @jonathanrainer PR [#1961](#1961 - **Update apollographql/router to v1.50.0 - @jonathanrainer PR [#1954](#1954 - **Trigger GitHub Actions from CircleCI - @nmoutschen PR [#1959](#1959 - **Add docs team to CODEOWNERS - @aaronArinder PR [#1965](#1965 - **Fix up Release CI and explicitly add tokio `rt-multi-thread flag` - @jonathanrainer PR [#1972](#1972 - **Add context to auth output when saving an API Key - @loshz PR [#1974](#1974 ## 📚 Documentation - **Minor update to README.md - @tratzlaff PR [#1880](#1880 Fixes use of numbered lists in the README.md - **Remove failing/redundant links from docs - @dotdat PR [#1894](#1894 - **Update docs style - @Meschreiber PR [#1883](#1883 Update formatting and admonitions to most recent conventions. - **Update frontmatter - @Meschreiber PR [#1898](#1898 Updates title casing and adds metadata to subtitles - **Clarify `subgraph publish` can only create variants not graphs - @Meschreiber PR [#1938](#1938 - **Make example using `-` instead of filepath clearer - @aaronArinder PR [#1963](#1963 - **Update Router terminology - @Meschreiber PR [#1925](#1925 Update the uses of Apollo Router to GraphOS Router or Apollo Router Core where necessary - **Update documentation to make it clear we collect CPU Architecture, per command - @aaronArinder PR [#1964](#1964

renovate bot requested a review from EverlastingBugstopper as a code owner October 28, 2023 12:04

renovate bot added the 🎄 dependencies label Oct 28, 2023

renovate bot force-pushed the renovate/node-20.x branch from f782c0a to c5e125d Compare November 4, 2023 10:10

renovate bot force-pushed the renovate/node-20.x branch from c5e125d to f64286b Compare November 11, 2023 10:27

renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 62cfbe9 to cf08677 Compare November 25, 2023 10:14

renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 89cde9e to 7fe9184 Compare December 16, 2023 09:07

renovate bot requested a review from abernix as a code owner December 16, 2023 09:07

abernix removed the request for review from EverlastingBugstopper January 10, 2024 12:50

renovate bot force-pushed the renovate/node-20.x branch from 7fe9184 to 2a55b2a Compare January 13, 2024 10:40

renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from f1452f7 to 9c60dd8 Compare January 27, 2024 10:21

renovate bot force-pushed the renovate/node-20.x branch from 9c60dd8 to f13a8a0 Compare February 3, 2024 08:29

renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 7bf4ff6 to 78a1479 Compare February 24, 2024 08:06

renovate bot force-pushed the renovate/node-20.x branch from 78a1479 to f40c35a Compare March 16, 2024 09:16

renovate bot force-pushed the renovate/node-20.x branch 3 times, most recently from fd8b270 to 4cc0d6b Compare April 6, 2024 07:23

renovate bot force-pushed the renovate/node-20.x branch from 4cc0d6b to 5a807bb Compare April 13, 2024 09:54

abernix removed their request for review April 19, 2024 11:02

renovate bot force-pushed the renovate/node-20.x branch from 5a807bb to 87ae46f Compare April 20, 2024 08:34

renovate bot requested a review from a team as a code owner April 20, 2024 08:34

renovate bot force-pushed the renovate/node-20.x branch from 87ae46f to 139357c Compare April 27, 2024 07:34

renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from ae21131 to 242ef19 Compare May 11, 2024 07:50

renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 617e18a to e2cfc50 Compare May 25, 2024 07:26

chore(deps): update node.js to v20

beef496

aaronArinder force-pushed the renovate/node-20.x branch from e2cfc50 to beef496 Compare May 29, 2024 19:25

aaronArinder approved these changes May 29, 2024

View reviewed changes

aaronArinder merged commit eb16860 into main May 29, 2024
10 checks passed

aaronArinder deleted the renovate/node-20.x branch May 29, 2024 19:37

jonathanrainer added this to the v0.24.0 milestone Jul 10, 2024

jonathanrainer added the maintenance 🛠️ label Jul 10, 2024

jonathanrainer mentioned this pull request Jul 12, 2024

release: v0.24.0 #1973

Merged

BrewTestBot mentioned this pull request Jul 15, 2024

rover 0.24.0 Homebrew/homebrew-core#177373

Merged

WontonSam mentioned this pull request Aug 5, 2024

[Snyk] Upgrade @apollo/rover from 0.14.2 to 0.24.0 WontonSam/apollo-federation-subgraph-compatibility#378

Open

WontonSam mentioned this pull request Aug 14, 2024

[Snyk] Upgrade @apollo/rover from 0.14.2 to 0.25.0 WontonSam/apollo-federation-subgraph-compatibility#416

Open

WontonSam mentioned this pull request Sep 11, 2024

[Snyk] Upgrade: , , , , , execa, make-fetch-happen WontonSam/apollo-federation-subgraph-compatibility#501

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update node.js to v20 #1778

chore(deps): update node.js to v20 #1778

renovate bot commented Oct 28, 2023 •

edited

Loading

chore(deps): update node.js to v20 #1778

chore(deps): update node.js to v20 #1778

Conversation

renovate bot commented Oct 28, 2023 • edited Loading

Release Notes

v20.13.1: 2024-05-09, Version 20.13.1 'Iron' (LTS), @​marco-ippolito

2024-05-09, Version 20.13.1 'Iron' (LTS), @​marco-ippolito

Revert "tools: install npm PowerShell scripts on Windows"

Commits

v20.13.0

v20.12.2: 2024-04-10, Version 20.12.2 'Iron' (LTS), @​RafaelGSS

Notable Changes

Commits

v20.12.1

v20.12.0

v20.11.1

v20.11.0

v20.10.0

v20.9.0

v20.8.1: 2023-10-13, Version 20.8.1 (Current), @​RafaelGSS

Notable Changes

Commits

v20.8.0: 2023-09-28, Version 20.8.0 (Current), @​ruyadorno

Notable Changes

Stream performance improvements

Rework of memory management in vm APIs with the importModuleDynamically option

Other notable changes

Commits

v20.7.0: 2023-09-18, Version 20.7.0 (Current), @​UlisesGascon

Notable Changes

Commits

Configuration

renovate bot commented Oct 28, 2023 •

edited

Loading

`v20.13.1`: 2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

`v20.13.0`

`v20.12.2`: 2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS

`v20.12.1`

`v20.12.0`

`v20.11.1`

`v20.11.0`

`v20.10.0`

`v20.9.0`

`v20.8.1`: 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

`v20.8.0`: 2023-09-28, Version 20.8.0 (Current), @ruyadorno

Rework of memory management in `vm` APIs with the `importModuleDynamically` option

`v20.7.0`: 2023-09-18, Version 20.7.0 (Current), @UlisesGascon